diff mbox series

[net] net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl

Message ID 53659f28be8bc336c113b5254dc637cc76bbae91.1606987074.git.dcaratti@redhat.com (mailing list archive)
State Accepted
Commit 13de4ed9e3a9ccbe54d05f7d5c773f69ecaf6c64
Delegated to: Netdev Maintainers
Headers show
Series [net] net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl | expand

Checks

Context Check Description
netdev/cover_letter success Link
netdev/fixes_present success Link
netdev/patch_count success Link
netdev/tree_selection success Clearly marked for net
netdev/subject_prefix success Link
netdev/source_inline success Was 0 now: 0
netdev/verify_signedoff success Link
netdev/module_param success Was 0 now: 0
netdev/build_32bit success Errors and warnings before: 1 this patch: 1
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/verify_fixes success Link
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 9 lines checked
netdev/build_allmodconfig_warn success Errors and warnings before: 1 this patch: 1
netdev/header_inline success Link
netdev/stable success Stable not CCed

Commit Message

Davide Caratti Dec. 3, 2020, 9:58 a.m. UTC
skb_mpls_dec_ttl() reads the LSE without ensuring that it is contained in
the skb "linear" area. Fix this calling pskb_may_pull() before reading the
current ttl.

Found by code inspection.

Fixes: 2a2ea50870ba ("net: sched: add mpls manipulation actions to TC")
Reported-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
---
 net/core/skbuff.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

patchwork-bot+netdevbpf@kernel.org Dec. 3, 2020, 7:20 p.m. UTC | #1
Hello:

This patch was applied to netdev/net.git (refs/heads/master):

On Thu,  3 Dec 2020 10:58:21 +0100 you wrote:
> skb_mpls_dec_ttl() reads the LSE without ensuring that it is contained in
> the skb "linear" area. Fix this calling pskb_may_pull() before reading the
> current ttl.
> 
> Found by code inspection.
> 
> Fixes: 2a2ea50870ba ("net: sched: add mpls manipulation actions to TC")
> Reported-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
> Signed-off-by: Davide Caratti <dcaratti@redhat.com>
> 
> [...]

Here is the summary with links:
  - [net] net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl
    https://git.kernel.org/netdev/net/c/13de4ed9e3a9

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
diff mbox series

Patch

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 06c526e0d810..e578544b2cc7 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5786,6 +5786,9 @@  int skb_mpls_dec_ttl(struct sk_buff *skb)
 	if (unlikely(!eth_p_mpls(skb->protocol)))
 		return -EINVAL;
 
+	if (!pskb_may_pull(skb, skb_network_offset(skb) + MPLS_HLEN))
+		return -ENOMEM;
+
 	lse = be32_to_cpu(mpls_hdr(skb)->label_stack_entry);
 	ttl = (lse & MPLS_LS_TTL_MASK) >> MPLS_LS_TTL_SHIFT;
 	if (!--ttl)